Linux Kernel EUVD-2025-210081

Exploitation requires: (1) the kernel must be compiled with CONFIG_DRM_VKMS enabled or the vkms.ko module must be loaded; (2) the attacker must have local shell access and at minimum low-privileged access to a DRM device node (typically group 'video' or 'render' membership); (3) the vulnerable code path is reached by interacting with the VKMS CRTC vblank subsystem. Limiting factors: VKMS is not enabled by default in most production distributions - it is a testing/CI driver, so typical server, desktop, or embedded deployments are not affected unless explicitly configured. Root or special privilege is not required, but local code execution on a VKMS-enabled host is a prerequisite. Remote exploitation is not possible given AV:L.

Real-world risk is low. The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) correctly reflects local-only exploitation with low privilege, meaning an attacker must already have shell or DRM device access on the target machine. EPSS at 0.02% (5th percentile) confirms near-zero exploitation interest from the threat intelligence community. The vulnerability is not in CISA KEV, and no public exploit or POC has been identified. The 'Information Disclosure' tag in the source data contradicts the CVSS C:N metric - no confidentiality impact is indicated by the vector, and the description confirms only availability impact; this tag appears to be a tagging artifact and should not be weighted. The primary risk is kernel instability on systems that actively use VKMS, which is a niche driver. Production systems running VKMS in non-test roles are uncommon, further depressing real-world exposure.

A local attacker or unprivileged process with access to the DRM device node on a system running the VKMS driver triggers the vblank timer code path - for example by opening /dev/dri/cardN and issuing vblank wait ioctls - causing the improperly managed custom hrtimer to fire, cancel, or reinitialize in a way that corrupts kernel timer state. This results in a kernel panic or system hang, achieving local denial of service. No public proof-of-concept exists at time of analysis.